   be configured via the KEYCLOAK_URL env var."
   [keycloak-public-client auth0-public-client authorizer]
   (let [keycloak-verifier (RSASSAVerifier. (:rsa-key keycloak-public-client))
-        auth0-verifier (RSASSAVerifier.  (:rsa-key auth0-public-client))]
+        auth0-verifier (RSASSAVerifier. (:rsa-key auth0-public-client))]
     (fn [handler]
       (fn [{:keys [tenant] :as req}]
         (if-let [token (jwt/jwt-token req)]

      application-json-type))

(def internal-server-error
  (-> (response/response "Internal server errror")
      (response/status 500)
      application-json-type))

(defmethod ig/init-key :akvo.lumen.auth/wrap-api-authorization
  [_ {:keys [authorizer]}]

;;; Authorization helpers
;;;

(defmulti api-authz?
  (fn [{:strs [iss] :as jwt-claims}]
    (cond
      (string/ends-with? iss "eu.auth0.com/") :auth0
      (or (= iss "https://kc.akvotest.org/auth/realms/akvo")
          (= iss "https://login.akvo.org/auth/realms/akvo")) :keycloak)))

#_(defmethod api-authz? :auth0
    [{:strs [email email_verified] :as jwt-claims}]
    (let [flag-path ["https://akvo.org/app_metadata" "lumen" "features"
                     "apiAuthz"]
          flag (get-in jwt-claims flag-path)]
      (and (and (some? flag) flag)
           (and (some? email_verified) email_verified)
           (and (some? email) (string/ends-with? email "@akvo.org")))))

;; If authenticated with auth0 API authz is required
(defmethod api-authz? :auth0
  [{:strs [email email_verified] :as jwt-claims}]
  true)

(defmethod api-authz? :keycloak
  [{:strs [email family_name]}]
  (and
   (and (some? family_name) (string/ends-with? family_name "$auth"))
   (and (some? email) (string/ends-with? email "@akvo.org"))))

(defn- application-json-type
  "code taken from ring.middleware.json/wrap-json-response"
